n8n Security Vulnerabilities: Disclosure and Patch Track Record
A track-record review of how transparently and quickly n8n discloses and patches n8n security vulnerabilities, using advisories, CERT alerts and research.
Checked against the cited sources on .
n8n Security Vulnerabilities: Scope and Review Criteria
This review asks how transparently and quickly n8n discloses and patches n8n security vulnerabilities, and what that track record means for a technical lead running n8n on their own infrastructure. We look at three things only: how fast a reported flaw turns into a published advisory, how much technical detail each advisory gives a defender, and how clear n8n's patch and workaround guidance is for cloud versus self-hosted deployments. We lean on n8n's own GitHub advisories and policy pages, on national cybersecurity authority alerts, and on independent security reporting from the same period, mostly late 2025 into early 2026.
We are not attempting a full history of every n8n CVE ever filed. The evidence available to us concentrates on a cluster of advisories from November 2025 through February 2026, plus one older 2023 case, so this is a review of documented examples rather than a complete multi-year trend.
How n8n's Vulnerability Disclosure Program Is Structured
n8n's security policy on GitHub tells anyone who finds a flaw to report it through a formal Vulnerability Disclosure Program rather than emailing a maintainer directly, according to n8n's SECURITY.md page. That page is a short policy stub without version history, so it is not possible to say how long this formal channel has existed.
n8n's VP of Engineering addressed this pattern directly in the company's own blog, after the growing pace of published advisories prompted questions from users about whether the project had a security problem.
n8n's own trust page also describes a recurring testing regime: third-party vulnerability scans at least every 90 days and a third-party penetration test at least once a year, as part of its threat and vulnerability management program. That is n8n's self-reported description of its own process, not an independently audited account of how often those tests actually ran.
Sources: Security Policy · n8n-io/n8n · GitHub, Security
Disclosure Speed in Practice: What Recent Timelines Show
Put next to each other, recent n8n security vulnerabilities show a pattern worth naming directly: patches have sometimes shipped quietly, weeks before the public advisory caught up. For the flaw affecting n8n versions 1.65 through 1.120.4, n8n's own January 8, 2026 advisory says the fix shipped to its entire customer base on November 18, 2025 — but the advisory itself was not published until January 8, 2026, roughly seven weeks later. n8n explains this gap as deliberate, giving customers a window to update before the technical details became public.
Independent reporting adds a second account of a similar gap. CyberScoop's January 7, 2026 report says security firm Cyera found and reported the same CVE-2026-21858 to n8n on November 9, 2025, that n8n patched it on November 18, but that the CVE was not publicly assigned or disclosed until January 7, 2026 — about two months after the initial report. n8n did not respond to CyberScoop's request for comment, so only Cyera's side of that particular gap is on record there.
We think an embargo-style delay between patching and publishing can be a defensible security trade-off, since it stops attackers from reverse-engineering a fix before customers apply it. But it only works if every affected team is actually running recent releases during that quiet window, which is a big assumption for self-hosted n8n.
By the time Canada's Cyber Centre issued its January 12, 2026 alert, it noted that proof-of-concept exploits chaining CVE-2026-21858 with an earlier 2025 vulnerability were already circulating publicly, and separately flagged that n8n's 1.X version line reaches end of life by the start of March 2026.
Sources: Security Advisory: Security Vulnerability in n8n Versions 1.65-1.120.4 – n8n Blog, Researchers rush to warn defenders of max-severity defect in n8n | CyberScoop, AL26-001 – Vulnerabilities affecting n8n – CVE-2026-21858, CVE-2026-21877 and CVE-2025-68613 - Canadian Centre for Cyber Security
How Detailed Are n8n's CVE Advisories and Patch Guidance
Once published, n8n's GitHub security advisories tend to be technically substantive. The advisory for CVE-2025-68613 (GHSA-v98v-ff95-f3cp, published December 19, 2025) lists the affected version range, the patched version — n8n v1.122.0 — a CVSS vector, a CWE classification, and credit to the reporter.
- Affected and patched version ranges
- CVSS score and vector
- CWE weakness classification
- Credited reporter or research firm
- Workaround guidance where a workaround exists
Workarounds vary in strength. The advisory for the Pyodide-related Python Code node vulnerability (GHSA-62r4-hw23-cc8v, CVE-2025-68668, published December 24, 2025) gives three concrete mitigation options, including setting the environment variable N8N_PYTHON_ENABLED=false to disable the affected feature entirely. By contrast, the advisory for the expression-escape remote code execution flaw (GHSA-6cqr-8cfr-67f8, CVE-2026-25049, published February 4, 2026) says plainly that its listed workarounds do not fully remediate the risk and should only be used as a stopgap.
That same February 2026 advisory also notes that n8n has adopted CVSS 4.0 as its primary scoring standard going forward, while still publishing CVSS 3.1 scores for backward compatibility — a methodology detail rather than a speed signal, but one that helps defenders compare severity consistently.
Sources: n8n Remote Code Execution via Expression Injection · Advisory · n8n-io/n8n · GitHub, Arbitrary Command Execution in Pyodide based Python Code Node · Advisory · n8n-io/n8n · GitHub, Expression Escape Vulnerability Leading to RCE · Advisory · n8n-io/n8n · GitHub
External Validation: CERT Alerts and Independent Security Research
n8n's own advisories are not the only account. Belgium's national cybersecurity authority, the CCB, documented both CVE-2026-21858 and CVE-2026-21877 at the maximum CVSS score of 10.0 in its public advisory, last updated January 9, 2026. That advisory restates the version and mitigation data n8n itself provided, so it functions as a distribution channel rather than an independent technical audit.
| Source | Kind of account | What it adds |
|---|---|---|
| n8n's own advisory (Jan 8, 2026) | Vendor, official | Confirms the patch date and gives n8n's reason for the publication delay |
| CyberScoop, citing Cyera (Jan 7, 2026) | Independent security reporting | Gives Cyera's dates for when it first reported the flaw to n8n |
| Belgium's CCB (Jan 9, 2026) | National CERT alert | Confirms maximum severity scores for both critical CVEs |
| Canada's Cyber Centre (Jan 12, 2026) | National CERT alert | Confirms severity scores and notes public proof-of-concept exploits already circulating |
| Rapid7 (Jan 8, 2026, updated Jul 1, 2026) | Security vendor research | Consolidates five CVEs with publish dates and CVSS/NVD scores in one table |
Rapid7's threat research, first published January 8, 2026 and updated July 1, 2026, consolidates five CVEs affecting n8n disclosed between December 19, 2025 and January 7, 2026 into one table of publish dates and scores. Rapid7 sells vulnerability-management products, so its interest in highlighting n8n exposure is also a commercial one.
We'd treat cross-checking n8n's own posts against these CERT alerts and independent write-ups as standard practice rather than an optional extra, because the gaps between vendor framing and outside reporting are exactly where a self-hosted team's real exposure window hides.
This pattern of active, severe disclosures is not unique to late 2025. A 2023 privilege-escalation flaw, CVE-2023-27563, affecting n8n versions below 0.216.1, was documented in the GitHub Advisory Database on May 10, 2023, citing security firm Synacktiv's original research — though that entry gives no detail on n8n's own internal disclosure timeline for the case.
Sources: Warning: Two critical vulnerabilities in n8n can lead to remote code execution, Patch Immediately! | CCB Belgium, AL26-001 – Vulnerabilities affecting n8n – CVE-2026-21858, CVE-2026-21877 and CVE-2025-68613 - Canadian Centre for Cyber Security, Ni8mare and N8scape flaws among multiple critical vulnerabilities affecting n8n, n8n Privilege Escalation vulnerability · CVE-2023-27563 · GitHub Advisory Database · GitHub
What This Track Record Means for a Self-Hosted Team's Risk
Put together, the track record looks like a vendor that discloses but sometimes discloses late. n8n's advisories are technically detailed once published, and n8n runs a recurring testing regime of its own, but the gap between a quiet patch and a public write-up has run to roughly seven weeks on at least one well-documented case.
Our pragmatic read is that the gap between a quiet patch and a public advisory is the real operational risk for self-hosted teams, more than the raw count of n8n security vulnerabilities disclosed in any given quarter. A team that only reacts to advisory emails can sit unpatched for weeks without knowing it.
Canada's Cyber Centre alert also flagged that n8n's 1.X version line reaches end of life by the start of March 2026, which matters for any self-hosted team still planning its upgrade path rather than treating version upgrades as optional.
Sources: Security Advisory: Security Vulnerability in n8n Versions 1.65-1.120.4 – n8n Blog, Security, AL26-001 – Vulnerabilities affecting n8n – CVE-2026-21858, CVE-2026-21877 and CVE-2025-68613 - Canadian Centre for Cyber Security
Practical Recommendations for Self-Hosted Teams
None of this changes the basic job of a self-hosted team: stay close to current releases and build a process that does not depend on reading every blog post the day it goes up.
A technical lead who wants a clear answer to whether an instance is actually patched and hardened the way these advisories assume usually needs someone to check the live setup, not just the policy page.
Sources: Security Advisory: Security Vulnerability in n8n Versions 1.65-1.120.4 – n8n Blog, Researchers rush to warn defenders of max-severity defect in n8n | CyberScoop, n8n Remote Code Execution via Expression Injection · Advisory · n8n-io/n8n · GitHub, Arbitrary Command Execution in Pyodide based Python Code Node · Advisory · n8n-io/n8n · GitHub, Warning: Two critical vulnerabilities in n8n can lead to remote code execution, Patch Immediately! | CCB Belgium, AL26-001 – Vulnerabilities affecting n8n – CVE-2026-21858, CVE-2026-21877 and CVE-2025-68613 - Canadian Centre for Cyber Security, Ni8mare and N8scape flaws among multiple critical vulnerabilities affecting n8n
